Jackscrew End Stop Probably Cause of AS 261 Crash
Guest
Posts: n/a
Jackscrew End Stop Probably Cause of AS 261 Crash
The Seattle Times (Washington state, USA), via ABC News reports that an NTSB investigator, through simulation, found that the end stop on the jackscrew of the MD-80 is now believed to be the proximate cause of the final and fatal plunge of AS 261 on 1/31/00. When the end stop broke, it permitted the stabilizer to tilt 22 degrees, far in excess of the maximum 2.2 degrees tilt. A stabilizer tilt of 22 degrees matches the flight data.
It all seems so neat. Can other explanations still exist? How perfect are flight simulators in replicating such data?
------------------
R. J. Emery
It all seems so neat. Can other explanations still exist? How perfect are flight simulators in replicating such data?
------------------
R. J. Emery
Guest
Posts: n/a
The one-in-a-billion figure quoted in the news article is standard for certification under FAA rules. The certification requirements state that there should be no single point failure that would cause death or loss of the aircraft. If such failures are not able to be designed out then the manufacturer must show that statistically, the failure should occur no more frequently that 1 10-9 or one time in a billion hours of fleet operation. First of all, it must be understood that the ultimate number is arrived at by manipulating percieved or demonstrated failure rates that may or may not relate to the element being analyzed.
This number is then incorporated into a safety hazards analysis (Fault Tree) and it is further manipulated through Boolean Algebra so that at the top level the ultimate loss of the horizontal stabilizer can be shown to be 1 10-12 or higher. It's all numbers and they do not necessarily reflect what the real failure rate is.
------------------
The Cat
[This message has been edited by Lu Zuckerman (edited 20 November 2000).]
This number is then incorporated into a safety hazards analysis (Fault Tree) and it is further manipulated through Boolean Algebra so that at the top level the ultimate loss of the horizontal stabilizer can be shown to be 1 10-12 or higher. It's all numbers and they do not necessarily reflect what the real failure rate is.
------------------
The Cat
[This message has been edited by Lu Zuckerman (edited 20 November 2000).]
Swounger
Join Date: May 1999
Location: New York, NY USA
Posts: 422
Likes: 0
Received 0 Likes
on
0 Posts
The hearing will be December 10th, 2002 at 9:30 Eastern US time. The audio will be webcast. www.ntsb.gov
First of all, it must be understood that the ultimate number is arrived at by manipulating percieved or demonstrated failure rates that may or may not relate to the element being analyzed.
This number is then incorporated into a safety hazards analysis (Fault Tree) and it is further manipulated through Boolean Algebra so that at the top level the ultimate loss of the horizontal stabilizer can be shown to be 1 10-12 or higher. It's all numbers and they do not necessarily reflect what the real failure rate is.
This number is then incorporated into a safety hazards analysis (Fault Tree) and it is further manipulated through Boolean Algebra so that at the top level the ultimate loss of the horizontal stabilizer can be shown to be 1 10-12 or higher. It's all numbers and they do not necessarily reflect what the real failure rate is.
The assumption being that multiple combinations of failures and conditions must occur to have led to this accident.
So what real failure rate was the unexpected archilies heal in this accident ?
and what action should be taken to address it?
Iconoclast
Join Date: Sep 2000
Location: The home of Dudley Dooright-Where the lead dog is the only one that gets a change of scenery.
Posts: 2,132
Likes: 0
Received 0 Likes
on
0 Posts
Figures lie and liars figure rule No.1 when verifying reliability and safety.
To: lomapaseo
First of all, I was not involved in the Alaska Air incident or with McDonnell Douglas so I can only comment on the system that is used to predict the reliability and ultimate safety of an aircraft or any other system. Explaining Reliability and Safety is extremely difficult unless the person addressed is familiar with the development of a Fault Tree Analysis (FTA) and if they are familiar with the development of Reliability block diagrams (RBD) and Failure Modes Effects Criticality Analyses (FMECA).
The mythical failure rate of 10 9 can be addressed two ways. The FARs require that a single point failure that can contribute to the loss of an aircraft can occur no more frequently than 10 9 and if all possible it should be designed out. The 10 9 figure most people quote does not apply to the aircraft level but instead, it applies to system failure that can cause loss of the aircraft. The FARs and the JARs will specify the acceptable frequency of a system failure that can cause a minor problem to loss of the aircraft and the upper limit is usually 10 9.
Here is how the system relies on the manipulation of numbers. If, the regulations specify that a flap or slat system can lock-up no more frequently than 10 6, the reliability engineer is forced to use non realistic failure rates for the individual components that can cause lock-up as there may be several hundred in the respective systems whose failure can result in lock-up. Where do these failure rates come from? Mostly from government developed databases that contain several hundred items that may or may not be used on aircraft. The reliability engineer must select a usable failure rate from an item that is used in a submarine and multiply it by an environmental K factor to obtain the failure rate he needs for his aircraft. In some cases the failure rate will have an upper, median and lower level of confidence. He is free to pick whichever confidence level best fits his calculation and ultimately arrives at the desired failure rate of 10 6. If the requirement is for runaway or non movement when commanded is 10 9 then the search for useable failure numbers becomes even more ridiculous.
So now after making the reliability calculation using non-realistic numbers the Reliability Engineer passes them to the Systems Safety Engineer. The Systems Safety Engineer then creates a FTA, which, is made up of gates the most common of which are And gates & Or gates. The diagram is from the top down meaning that the top gate is the actual failure resulting in breaching the 10 9 requirement. The top gate is connected to the lower gates by connection lines or, failure paths. The failure paths leading to the top gate come from either And gates or, Or gates and each of those gates represents a failure that can lead upward to lead to the breach of the 10 9 requirement. There can be as many gates of both kinds to reflect the system complexity. There may be as many FTAs as required to reflect all of the services that supply the system such as Hydraulics, Electrical and electronics and the hardware elements of the system.
Imagine the gates as being locks. On an Or gate there can be several failures each of which has a key to the lock and any one of these failure can pass through the gate. On an And gate each of the failures have key to the lock but all must be present in order for the collective failure to pass through the gate. This is a simplification but easy to understand. Now for the mathematics (Boolean Algebra). Let’s assume that an Or gate has five failures each of which can open the lock. The math is 1 10 6+1 10 6+1 10 6+ 1 10 6=1 10 6 with a result of 5 10 6. Using the same numbers let’s look at an AND gate. The math is 1 10 6x1 10 6x1 10 6x 1 10 6x1 10 6x with a result of 1 10 30. The numbers are unrealistic because they stem from numbers that have no relevance to the calculations and secondly they are unrealistic when you compare them to actual recorded failures.
Here is the final kicker. The FTAs are for the systems and not the aircraft. Each FTA terminates in assessing the probability of failure of the specific system. This should be carried one step further by making a FTA with an OR gate representing the aircraft with each of the systems feeding into that gate. Because it is an Or gate you would most likely come up with a catastrophic loss of something in the area of 1 10 8 or possibly lower which truly reflects the crash rate of commercial aircraft. However the FAA does not require this assessment at the aircraft level. So much for safety.
One final note. In order to gain certification the FTA and the attendent report are required among other engineering reports but the FAA never sees the RBD or the FMECA and they are not at all concerned with how the failure rates were derived. If they ever express interest in seeing these documents they must request permission from the manufacturer.
So what real failure rate was the unexpected Achilies heel in this accident ?
The mythical failure rate of 10 9 can be addressed two ways. The FARs require that a single point failure that can contribute to the loss of an aircraft can occur no more frequently than 10 9 and if all possible it should be designed out. The 10 9 figure most people quote does not apply to the aircraft level but instead, it applies to system failure that can cause loss of the aircraft. The FARs and the JARs will specify the acceptable frequency of a system failure that can cause a minor problem to loss of the aircraft and the upper limit is usually 10 9.
Here is how the system relies on the manipulation of numbers. If, the regulations specify that a flap or slat system can lock-up no more frequently than 10 6, the reliability engineer is forced to use non realistic failure rates for the individual components that can cause lock-up as there may be several hundred in the respective systems whose failure can result in lock-up. Where do these failure rates come from? Mostly from government developed databases that contain several hundred items that may or may not be used on aircraft. The reliability engineer must select a usable failure rate from an item that is used in a submarine and multiply it by an environmental K factor to obtain the failure rate he needs for his aircraft. In some cases the failure rate will have an upper, median and lower level of confidence. He is free to pick whichever confidence level best fits his calculation and ultimately arrives at the desired failure rate of 10 6. If the requirement is for runaway or non movement when commanded is 10 9 then the search for useable failure numbers becomes even more ridiculous.
So now after making the reliability calculation using non-realistic numbers the Reliability Engineer passes them to the Systems Safety Engineer. The Systems Safety Engineer then creates a FTA, which, is made up of gates the most common of which are And gates & Or gates. The diagram is from the top down meaning that the top gate is the actual failure resulting in breaching the 10 9 requirement. The top gate is connected to the lower gates by connection lines or, failure paths. The failure paths leading to the top gate come from either And gates or, Or gates and each of those gates represents a failure that can lead upward to lead to the breach of the 10 9 requirement. There can be as many gates of both kinds to reflect the system complexity. There may be as many FTAs as required to reflect all of the services that supply the system such as Hydraulics, Electrical and electronics and the hardware elements of the system.
Imagine the gates as being locks. On an Or gate there can be several failures each of which has a key to the lock and any one of these failure can pass through the gate. On an And gate each of the failures have key to the lock but all must be present in order for the collective failure to pass through the gate. This is a simplification but easy to understand. Now for the mathematics (Boolean Algebra). Let’s assume that an Or gate has five failures each of which can open the lock. The math is 1 10 6+1 10 6+1 10 6+ 1 10 6=1 10 6 with a result of 5 10 6. Using the same numbers let’s look at an AND gate. The math is 1 10 6x1 10 6x1 10 6x 1 10 6x1 10 6x with a result of 1 10 30. The numbers are unrealistic because they stem from numbers that have no relevance to the calculations and secondly they are unrealistic when you compare them to actual recorded failures.
Here is the final kicker. The FTAs are for the systems and not the aircraft. Each FTA terminates in assessing the probability of failure of the specific system. This should be carried one step further by making a FTA with an OR gate representing the aircraft with each of the systems feeding into that gate. Because it is an Or gate you would most likely come up with a catastrophic loss of something in the area of 1 10 8 or possibly lower which truly reflects the crash rate of commercial aircraft. However the FAA does not require this assessment at the aircraft level. So much for safety.
One final note. In order to gain certification the FTA and the attendent report are required among other engineering reports but the FAA never sees the RBD or the FMECA and they are not at all concerned with how the failure rates were derived. If they ever express interest in seeing these documents they must request permission from the manufacturer.
Last edited by Lu Zuckerman; 8th Dec 2002 at 02:16.
Lu
You missed the important point of my post above. I have no argument with the FMEA process and the regulation under which it serves (25.1309, 33.75 etc.) I do have a problem with the lack of real teeth in the adherence to this regulation by part 39 Continued Airworthiness..
If the FAA/JAA were to really tie these two parts together they could get at both the corrective actions and the root cause.
In the case of Alaska Airlines, I can not understand what really went wrong other than s**t happens and the NTSB is likely to recommend only that better maintenance should have fixed this without really delving into the more global tie in between maintenance and design system safety.
Hopefully the aircraft designer will have learned a lesson here as well and drive this lesson back into future designs without waiting for the NTSB to figure it out.
Maybe John Goglia of the NTSB will get some teeth into the upcoming hearing by addressing this subject
You missed the important point of my post above. I have no argument with the FMEA process and the regulation under which it serves (25.1309, 33.75 etc.) I do have a problem with the lack of real teeth in the adherence to this regulation by part 39 Continued Airworthiness..
If the FAA/JAA were to really tie these two parts together they could get at both the corrective actions and the root cause.
In the case of Alaska Airlines, I can not understand what really went wrong other than s**t happens and the NTSB is likely to recommend only that better maintenance should have fixed this without really delving into the more global tie in between maintenance and design system safety.
Hopefully the aircraft designer will have learned a lesson here as well and drive this lesson back into future designs without waiting for the NTSB to figure it out.
Maybe John Goglia of the NTSB will get some teeth into the upcoming hearing by addressing this subject
Iconoclast
Join Date: Sep 2000
Location: The home of Dudley Dooright-Where the lead dog is the only one that gets a change of scenery.
Posts: 2,132
Likes: 0
Received 0 Likes
on
0 Posts
Nobody really cares. Not the airframe manufacturers and especially the FAA
To: lomapaseo
Based on my dealings with the FAA, it is analogous to hitting a mule between the ears with a 2 X 4 to get his attention, and then, you don’t know if he will do what you want, and, this goes not only for the mule but for the other certification authorities as well.
Here is an example. I was a senior RMS engineer on a major European aircraft program. I uncovered several faults in the design that could potentially lead to loss of the aircraft. I brought the problem to the attention of my boss, the VP of the company as well as the senior program manager. They refused to deal with the problem because it might have cost them money. I took the problem to the integration contractor and got the same answer. I then took the problem to the system designer in the UK and was told that they were sympathetic with my problem but they could not do anything about it. After I left the program I sent a letter to the FAA telling them of the design deficiencies and it took several months to get a response telling me that they would look into it. Several months later I got a second letter telling me that they (the FAA) had contacted the DGCA in France. The DGCA told the FAA that the design had been changed. I checked with a former colleague and he told me the design had not been changed. With that I sent a very strongly worded letter to the FAA and when they finally took action the Vice-President and chief Program manager were fired. However the design was never changed.
The contract required that the prime contractor be advised immediately of a design defect that effected Safety, Reliability and Maintainability. My firm, the integration contractor and the systems designer never informed the prime contractor of the problem. It is also obvious that if the design was never changed, the prime contractor never ran the necessary tests that would have uncovered one of the faults.
As I said previously, so much for safety.
Based on my dealings with the FAA, it is analogous to hitting a mule between the ears with a 2 X 4 to get his attention, and then, you don’t know if he will do what you want, and, this goes not only for the mule but for the other certification authorities as well.
Here is an example. I was a senior RMS engineer on a major European aircraft program. I uncovered several faults in the design that could potentially lead to loss of the aircraft. I brought the problem to the attention of my boss, the VP of the company as well as the senior program manager. They refused to deal with the problem because it might have cost them money. I took the problem to the integration contractor and got the same answer. I then took the problem to the system designer in the UK and was told that they were sympathetic with my problem but they could not do anything about it. After I left the program I sent a letter to the FAA telling them of the design deficiencies and it took several months to get a response telling me that they would look into it. Several months later I got a second letter telling me that they (the FAA) had contacted the DGCA in France. The DGCA told the FAA that the design had been changed. I checked with a former colleague and he told me the design had not been changed. With that I sent a very strongly worded letter to the FAA and when they finally took action the Vice-President and chief Program manager were fired. However the design was never changed.
The contract required that the prime contractor be advised immediately of a design defect that effected Safety, Reliability and Maintainability. My firm, the integration contractor and the systems designer never informed the prime contractor of the problem. It is also obvious that if the design was never changed, the prime contractor never ran the necessary tests that would have uncovered one of the faults.
As I said previously, so much for safety.
Quote from above
Lu, a true safety professsional should point the way rather than complain about yesterdays journey
Nobody really cares. Not the airframe manufacturers and especially the FAA
Lu, a true safety professsional should point the way rather than complain about yesterdays journey
Iconoclast
Join Date: Sep 2000
Location: The home of Dudley Dooright-Where the lead dog is the only one that gets a change of scenery.
Posts: 2,132
Likes: 0
Received 0 Likes
on
0 Posts
In reply
To: lomapaseo
I have been doing this work since 1968 working on commercial and military aircraft, helicopters, ships, submersible mine detectors, atomic energy and a pharmaceutical plant among others. In every case I told my supervisors and fellow workers about the shortcomings of the regulations governing RMS. The bosses looked on me as a troublemaker and my associates told me to stop complaining because the job put bread and butter on the table. So it appears that the other “professionals” in the field don’t care either. The reason I spout off on this forum about the failings of the system and the regulations is because a lot of people that control or have influence over this problem including yourself will take action. I’m 72 years old and don’t have that much time to try and change things but maybe someone else can.
Lu, a true safety professsional should point the way rather than complain about yesterdays journey
The reason I spout off on this forum about the failings of the system and the regulations is because a lot of people that control or have influence over this problem including yourself will take action. I’m 72 years old and don’t have that much time to try and change things but maybe someone else can.
If your employer did not allow you to contribute than there was always the public comment process to place your strong feelings in the record before the rule becomes law.
Anti feelings, however can not be effectively adjudicated by folks who felt that the best was already offered.
So far, in reading bewteen the lines, I suspect that we did accomodate some of your concerns.
Join Date: Mar 2000
Location: Obvious
Age: 78
Posts: 301
Likes: 0
Received 0 Likes
on
0 Posts
THE NASA FAILSAFE JACKSCREW
The solution to the Alaska 261 jackscrew failure problem is the recent NASA invention of the FAILSAFE JACKSCREW. It was cunningly designed by NASA to overcome a single critical failure Shuttle-Launch catastrophe problem (failure of disconnects and pull-backs prior to lift-off). NASA also identified it as a solution to the type of failure that downed Alaska 261. There are photos, drawings and descriptions at the following links.
link ONE
link TWO
link THREE
link FOUR (NASA's failsafe jackscrew pdf file)
link FIVE
link SIX
link SEVEN
link EIGHT
link NINE
link TEN Air Safety Week Magazine's Article on the FS Jackscrew
link ELEVEN Earlier Air Safety Week Article on the FailSafe Jackscrew (pdf file of 654kb)
Unfortunately the FAA (Transport Airplane Directorate) has already dismissed the Failsafe Jackscrew as being "out of the question" due to the Alaska 261 crash being caused solely by human failure (i.e. maintenance error inasmuch as a worn but not yet threadbare screw was not replaced two years before the crash and this failure to mantain being exacerbated by caked grease also preventing the screw-threads from being lubricated). The FAA's own Cost-benefit analysis does not justify the cost of replacing existing jackscrews with this NASA Failsafe Design.
The Story of why that failing AK261 jackscrew was NOT replaced is in large part the story of Whistleblower John Liotine (links 7 & 8).
On 10 Dec 02 the NTSB will possibly follow the lead of ex-member Dr Loeb when he condemned the 737 rudder design as having
insufficient "reliable redundancy". When McDD had the MD-80/90 jackscrew design certified originally it was upon the false premise that the horizontal stabilizer was "structure" and therefore did NOT come under that part of FAR25 that lays down strict redundancy and single-point failure rules for flight-controls. It is now patently obvious that the horizontal stabilizer and its jackscrew are indeed critical "flight controls"
link ONE
link TWO
link THREE
link FOUR (NASA's failsafe jackscrew pdf file)
link FIVE
link SIX
link SEVEN
link EIGHT
link NINE
link TEN Air Safety Week Magazine's Article on the FS Jackscrew
link ELEVEN Earlier Air Safety Week Article on the FailSafe Jackscrew (pdf file of 654kb)
Unfortunately the FAA (Transport Airplane Directorate) has already dismissed the Failsafe Jackscrew as being "out of the question" due to the Alaska 261 crash being caused solely by human failure (i.e. maintenance error inasmuch as a worn but not yet threadbare screw was not replaced two years before the crash and this failure to mantain being exacerbated by caked grease also preventing the screw-threads from being lubricated). The FAA's own Cost-benefit analysis does not justify the cost of replacing existing jackscrews with this NASA Failsafe Design.
The Story of why that failing AK261 jackscrew was NOT replaced is in large part the story of Whistleblower John Liotine (links 7 & 8).
On 10 Dec 02 the NTSB will possibly follow the lead of ex-member Dr Loeb when he condemned the 737 rudder design as having
insufficient "reliable redundancy". When McDD had the MD-80/90 jackscrew design certified originally it was upon the false premise that the horizontal stabilizer was "structure" and therefore did NOT come under that part of FAR25 that lays down strict redundancy and single-point failure rules for flight-controls. It is now patently obvious that the horizontal stabilizer and its jackscrew are indeed critical "flight controls"
Iconoclast
Join Date: Sep 2000
Location: The home of Dudley Dooright-Where the lead dog is the only one that gets a change of scenery.
Posts: 2,132
Likes: 0
Received 0 Likes
on
0 Posts
.
To: lomapaseo
They may be mixed up but here are the basic problems:
1) Most reliability and maintainability and many safety engineers have never turned a wrench in anger. Most of them have been transferred to the RMS department to avoid layoff. Most being design engineers will deal with the item under analysis as a mathematical entity instead of an element that is subject to abuse by its’ environment, by a hamfisted mechanic or possibly it has a design flaw or a manufacturing flaw. These things are very seldom taken into consideration during the reliability analysis.
2) In order to perform a reliability analysis the analyst requires a database that contains failure rates under a stated environment and stress level. Such a document does not exist. As previously stated the documents provided by the Government for use on reliability programs for government equipment are totally useless but if the analyst can prove that his number came from that database the government will accept it. These same databases are used for commercial aircraft and many other programs requiring Reliability analysis. The databases for electronic parts are quite complete so the problem of unusable information is mooted.
3) Reliability analysis was developed by the US Air Force to determine the best way to improve electronic system architecture. The analyst would create a block diagram reflecting the system design. He would insert fictitious failure rates in each block and using Boolean Algebra run a calculation to determine the system failure rate. Then by inserting redundancy of several kinds and using the same failure rates he would run his calculation again to see if there was any improvement in the end number. This would be performed several times until the analyst arrived at the optimum design. The end numbers were meaningless but they showed that by altering the design you could improve reliability. By requirement RMS analysis must be accomplished prior to freezing the design. Now because of financial constraints or whatever excuse engineering can come up with the analysis is done very close to design freeze and in some cases after design freeze. So whatever analysis is performed it does not mean a thing.
4) Now when a block diagram is constructed for a mechanical entity the analyst will create a block diagram reflecting the system architecture and plug in failure rates that come from the meaningless government database. The analyst will run his calculation to determine if he meets the contract requirements. If he can’t he will go back to the database and manipulate the numbers in order to meet contract requirements. One year later the company must show reliability growth and in order to do that the analyst will select even better numbers in order to show growth even though the design has not changed.
5) Engineers have a not invented here attitude when it comes to reliability or maintainability input.
I could go on for much more but I will be eating up space on Danny’s’ server. Suffice it to say, if you use the government-supplied system and can show that the analyses complied with those guidelines and specs and your numbers comply with the contract then it is acceptable. The UK has a Def Stan, which reflects the US Government specs, and they have the same problems.
Now consider the FTA, which is submitted to the certification authorities, comprises the failure rates determined in the reliability analyses. Computer engineers came up with the following quote and it is applicable here. Garbage In Garbage Out (GIGO).
I believe this has been carried far enough. I haven’t been influential in changing the system in 34 years and I doubt it will ever change as too many people have a vested interest in not changing it.
So far, in reading bewteen the lines, I suspect that we did accomodate some of your concerns.
They may be mixed up but here are the basic problems:
1) Most reliability and maintainability and many safety engineers have never turned a wrench in anger. Most of them have been transferred to the RMS department to avoid layoff. Most being design engineers will deal with the item under analysis as a mathematical entity instead of an element that is subject to abuse by its’ environment, by a hamfisted mechanic or possibly it has a design flaw or a manufacturing flaw. These things are very seldom taken into consideration during the reliability analysis.
2) In order to perform a reliability analysis the analyst requires a database that contains failure rates under a stated environment and stress level. Such a document does not exist. As previously stated the documents provided by the Government for use on reliability programs for government equipment are totally useless but if the analyst can prove that his number came from that database the government will accept it. These same databases are used for commercial aircraft and many other programs requiring Reliability analysis. The databases for electronic parts are quite complete so the problem of unusable information is mooted.
3) Reliability analysis was developed by the US Air Force to determine the best way to improve electronic system architecture. The analyst would create a block diagram reflecting the system design. He would insert fictitious failure rates in each block and using Boolean Algebra run a calculation to determine the system failure rate. Then by inserting redundancy of several kinds and using the same failure rates he would run his calculation again to see if there was any improvement in the end number. This would be performed several times until the analyst arrived at the optimum design. The end numbers were meaningless but they showed that by altering the design you could improve reliability. By requirement RMS analysis must be accomplished prior to freezing the design. Now because of financial constraints or whatever excuse engineering can come up with the analysis is done very close to design freeze and in some cases after design freeze. So whatever analysis is performed it does not mean a thing.
4) Now when a block diagram is constructed for a mechanical entity the analyst will create a block diagram reflecting the system architecture and plug in failure rates that come from the meaningless government database. The analyst will run his calculation to determine if he meets the contract requirements. If he can’t he will go back to the database and manipulate the numbers in order to meet contract requirements. One year later the company must show reliability growth and in order to do that the analyst will select even better numbers in order to show growth even though the design has not changed.
5) Engineers have a not invented here attitude when it comes to reliability or maintainability input.
I could go on for much more but I will be eating up space on Danny’s’ server. Suffice it to say, if you use the government-supplied system and can show that the analyses complied with those guidelines and specs and your numbers comply with the contract then it is acceptable. The UK has a Def Stan, which reflects the US Government specs, and they have the same problems.
Now consider the FTA, which is submitted to the certification authorities, comprises the failure rates determined in the reliability analyses. Computer engineers came up with the following quote and it is applicable here. Garbage In Garbage Out (GIGO).
I believe this has been carried far enough. I haven’t been influential in changing the system in 34 years and I doubt it will ever change as too many people have a vested interest in not changing it.
Join Date: Mar 2000
Location: Obvious
Age: 78
Posts: 301
Likes: 0
Received 0 Likes
on
0 Posts
That FMEA of the Maintenance Factor (human failings)
The Air Line Pilots Assoc. (ALPA) submission to the NTSB docket on the Alaska Flight 261 crash case is at this link. (a 750kb pdf file). It provides ample grist to support the case for retro-fit of a Fail-Safe Jackscrew. I would add a few thoughts:
The airplane is supposed to be certified against catastrophic failure, and the standard is to a probability of not more than 1 in a billion flights (1X10-9, or "extremely improbable"). If one is designing a system where maintenance is the failsafe mechanism, then we are in the realm of human error, which occurs more often than a rate of once every billion. Now we are talking "improbable" error rates in the range of one in a million 1X10-6) to once in 100 million (1x10-8). So timely and proper maintenance is not failsafe, since it can fail to be properly performed at orders of magnitude 1-3 times more often than the one in a billion standard.
As this document shows, the probability of failure was virtually one, since the work wasn't done. Given the potential for human failings, I believe one could credibly argue that any flight-critical system dependent on maintenance for safety is not failsafe - by definition.
You will note in this document that the FAA had no mechanism in place to track premature wear rates. Moreover, the FAA was a silent partner in the evolution of MSG-2 to MSG-3 maintenance protocols, by which inspection intervals were lengthened (and on the basis of virtually no in-service data; so much for "data-driven" safety). Note the artful wording
-- the FAA never "approved" the MSG-3 work. Rather, the FAA acknowledged the revised practices -- which is to say it did not assume responsibility and thereby seems to have neatly side-stepped the issue of being held accountable for the revised MSG-3 practices.
You will find more in this well-crafted document. If anyone wished to contest the FAA position on the Failsafe Jackscrew, it would be worthwhile first to try and establish the FAA's actual position (i.e. write to John Hickey at TAD and ask - or go FOIA). The counter-arguments Mr. Hickey has made, the position he appears to be taking on behalf of the FAA is logically indefensible, and it might serve to point out publicly just what the inconsistencies are. We shall set aside for the moment the moral and ethical escapism suggested by the material contained in the ALPA analysis.
The airplane is supposed to be certified against catastrophic failure, and the standard is to a probability of not more than 1 in a billion flights (1X10-9, or "extremely improbable"). If one is designing a system where maintenance is the failsafe mechanism, then we are in the realm of human error, which occurs more often than a rate of once every billion. Now we are talking "improbable" error rates in the range of one in a million 1X10-6) to once in 100 million (1x10-8). So timely and proper maintenance is not failsafe, since it can fail to be properly performed at orders of magnitude 1-3 times more often than the one in a billion standard.
As this document shows, the probability of failure was virtually one, since the work wasn't done. Given the potential for human failings, I believe one could credibly argue that any flight-critical system dependent on maintenance for safety is not failsafe - by definition.
You will note in this document that the FAA had no mechanism in place to track premature wear rates. Moreover, the FAA was a silent partner in the evolution of MSG-2 to MSG-3 maintenance protocols, by which inspection intervals were lengthened (and on the basis of virtually no in-service data; so much for "data-driven" safety). Note the artful wording
-- the FAA never "approved" the MSG-3 work. Rather, the FAA acknowledged the revised practices -- which is to say it did not assume responsibility and thereby seems to have neatly side-stepped the issue of being held accountable for the revised MSG-3 practices.
You will find more in this well-crafted document. If anyone wished to contest the FAA position on the Failsafe Jackscrew, it would be worthwhile first to try and establish the FAA's actual position (i.e. write to John Hickey at TAD and ask - or go FOIA). The counter-arguments Mr. Hickey has made, the position he appears to be taking on behalf of the FAA is logically indefensible, and it might serve to point out publicly just what the inconsistencies are. We shall set aside for the moment the moral and ethical escapism suggested by the material contained in the ALPA analysis.
Iconoclast
Join Date: Sep 2000
Location: The home of Dudley Dooright-Where the lead dog is the only one that gets a change of scenery.
Posts: 2,132
Likes: 0
Received 0 Likes
on
0 Posts
FAA=Hear no evil, Speak no evil,See no evil or, are they just a bunch of monkeys?
To: Belgique
Several years ago various human factors organizations in concert with reliability organizations tried to quantify human error. In essence to account for human error in systems and component failures. They worked for several years but never came up with a workable system. I don’t know if the following related to their findings but many organizations (Reliability) eliminated manufacturing error and maintenance error in the preparation of FMECAs because it could not be quantified like a failure rate even if the failure rate used was meaningless. I recently performed an FMECA on a business jet and included maintenance error, manufacturing defect, design defect as the mode of failure and I was told to remove them and only use the inherent failure rate for the part. In doing this it is assumed that the part will only fail at the specified rate and only at that rate and all of the other things that enter into the equation do not count.
The closest they came was in an Air Force study that correlated actual failures with false removals in order to calculate MTBUR (Mean Time Between Unscheduled Removal).
In the preparation of the FTA maintenance error can be a collateral driver and plugged into the diagram but it does not have a quantity (rate of human error) and could be listed only as a contributing factor in the failure.
Several years ago various human factors organizations in concert with reliability organizations tried to quantify human error. In essence to account for human error in systems and component failures. They worked for several years but never came up with a workable system. I don’t know if the following related to their findings but many organizations (Reliability) eliminated manufacturing error and maintenance error in the preparation of FMECAs because it could not be quantified like a failure rate even if the failure rate used was meaningless. I recently performed an FMECA on a business jet and included maintenance error, manufacturing defect, design defect as the mode of failure and I was told to remove them and only use the inherent failure rate for the part. In doing this it is assumed that the part will only fail at the specified rate and only at that rate and all of the other things that enter into the equation do not count.
The closest they came was in an Air Force study that correlated actual failures with false removals in order to calculate MTBUR (Mean Time Between Unscheduled Removal).
In the preparation of the FTA maintenance error can be a collateral driver and plugged into the diagram but it does not have a quantity (rate of human error) and could be listed only as a contributing factor in the failure.
On the subject, there's a website at http://ethics.tamu.edu/ that is well worth looking at, particularly the two guest contributions that are there at the moment.
The paper by the legal chappie about the result of cases where aircraft technicians in the US have been sacked for refusing to sign-off unsafe aircraft is quite disturbing in places.
G
The paper by the legal chappie about the result of cases where aircraft technicians in the US have been sacked for refusing to sign-off unsafe aircraft is quite disturbing in places.
G
Join Date: Mar 2000
Location: Obvious
Age: 78
Posts: 301
Likes: 0
Received 0 Likes
on
0 Posts
audio (real player) of hearing underway
http://www.gmu.edu/departments/capco.../ntsbaudio.ram
0930 Monday 10 Dec 02
http://www.ntsb.gov/Events/2000/AKA261/webcast.htm
Full VIDEO archive webcast will be available December 18;
transcripts will be posted later in the month.
0930 Monday 10 Dec 02
http://www.ntsb.gov/Events/2000/AKA261/webcast.htm
Full VIDEO archive webcast will be available December 18;
transcripts will be posted later in the month.
Join Date: Jun 2001
Location: Surrounded by aluminum, and the great outdoors
Posts: 3,780
Likes: 0
Received 0 Likes
on
0 Posts
One of you techies have a look at a jackscrew/actuator assembly on a SA-227 Metroliner, and explain why a design such as this cannot be installed ona jetliner......changing rules regulations....all kinds of people who sit on boards...etc...etc have all kinds of right ideas on how to fix the industry...unfortunately money talks...and the manufacturers have the money....and the politicians want it...and the FAA has no bollocks...so people will continue to die
Join Date: Dec 2001
Location: STL
Posts: 140
Likes: 0
Received 0 Likes
on
0 Posts
"So what real failure rate was the unexpected archilies heal in this
accident ? and what action should be taken to address it?"
lomapaseo, For argument's sake I'll offer a value of 0.3524163824. And I'm
not sure that the recommendations in the NTSB draft report go far enough in
addressing it.
There were two independent endplay measurement checks (each of which produced
a reported measurement based on several contributing measurements). The two
values were 0.040 and 0.033. If Ybar denotes the average of two independent
measurements of an endplay whose true but unknown value is mu, if S denotes
the sample standard deviation, then (Ybar - mu)/S/sqrt(2) is a Student-t
distribution with one degree of freedom. In this case Ybar = 0.0365, the
sample standard deviation equals 0.004949747468, and based on the two
measurements the probability that mu was greater than or equal to Douglas's
specification of 0.040 for the maximum limit was 0.3524163824. That's not a
failure rate value, just an indication that on the evidence the a/c should
not have been in the air.
Among the 16 NTSB recommendations - is that a record for one report?
- there is little mention of measurement error or procedures for dealing
with it. Recommendation 8 states "establish an end play check interval
that (1) accounts for the possibility of higher-than-expected wear rates
and measurement error in estimating acme nut thread wear."
Why limit the recommendation concerning measurement error to nut thread wear?
Why not specifically raise the issue of policy concerning measurements that
do not agree? The recommendations stress the need for recording wear
(recommendation 9) but such measurements may be of dubious value without other
actions. According to the ALPA submission that Belgique links to, the NTSB Systems
Group determined that "the worst example using an Alaska clone tool was a measured
endplay of .012 inches when the actual endplay was .023 inches." Given that
kind of inaccuracy an (acceptable) reading of 0.033 could easily have come from
actual endplay that exceeded not only Douglas's published maximum limit
specification but also the true maximum limit.